last executing test programs:

124.205601ms ago: executing program 3 (id=179):
stat(&(0x7f0000000000), &(0x7f0000000000))

124.128145ms ago: executing program 1 (id=180):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/cmdline', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/cmdline', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/cmdline', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/proc/cmdline', 0x800, 0x0)

124.067305ms ago: executing program 3 (id=181):
select(0x0, &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000))

123.952668ms ago: executing program 2 (id=182):
quotactl$Q_GETFMT(0x0, &(0x7f0000000000), 0x0, &(0x7f0000000000))

113.297396ms ago: executing program 1 (id=184):
fchdir(0xffffffffffffffff)

101.249647ms ago: executing program 0 (id=185):
getdents(0xffffffffffffffff, &(0x7f0000000000), 0x0)

101.168801ms ago: executing program 3 (id=186):
set_thread_area(&(0x7f0000000000))

56.650576ms ago: executing program 2 (id=187):
socket$nl_generic(0x10, 0x3, 0x10)

56.501856ms ago: executing program 0 (id=188):
getxattr(&(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), 0x0)

56.461646ms ago: executing program 1 (id=189):
wait4(0x0, 0x0, 0x0, 0x0)

56.346748ms ago: executing program 2 (id=190):
sched_setscheduler(0x0, 0x0, &(0x7f0000000000))

56.298358ms ago: executing program 0 (id=191):
setdomainname$auto(&(0x7f0000000000), 0x0)

56.141555ms ago: executing program 3 (id=192):
move_mount(0xffffffffffffffff, &(0x7f0000000000), 0xffffffffffffffff, &(0x7f0000000000), 0x0)

54.992453ms ago: executing program 1 (id=193):
setreuid(0x0, 0x0)

50.755102ms ago: executing program 2 (id=194):
clock_gettime(0x0, &(0x7f0000000000))

46.391366ms ago: executing program 0 (id=195):
vmsplice(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0)

509.4µs ago: executing program 1 (id=196):
fchownat(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x0)

393.116µs ago: executing program 3 (id=197):
mount_setattr(0xffffffffffffffff, &(0x7f0000000000), 0x0, &(0x7f0000000000), 0x0)

334.827µs ago: executing program 2 (id=198):
signalfd4(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0)

226.384µs ago: executing program 0 (id=199):
faccessat2(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0)

170.753µs ago: executing program 2 (id=200):
nanosleep(&(0x7f0000000000), 0x0)

100.197µs ago: executing program 1 (id=201):
getxattrat$auto(0xffffffffffffffff, &(0x7f0000000000), 0x0, &(0x7f0000000000), &(0x7f0000000000), 0x0)

50.887µs ago: executing program 3 (id=202):
rt_sigsuspend(&(0x7f0000000000), 0x0)

0s ago: executing program 0 (id=203):
setxattr(&(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), 0x0, 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '10.128.10.34' (ED25519) to the list of known hosts.
[   59.651537][ T5818] cgroup: Unknown subsys name 'net'
[   59.782225][ T5818] cgroup: Unknown subsys name 'cpuset'
[   59.790615][ T5818] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   61.124803][ T5818] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   64.319647][ T6047] ==================================================================
[   64.327760][ T6047] BUG: KASAN: slab-use-after-free in binder_add_device+0xa4/0xb0
[   64.335519][ T6047] Write of size 8 at addr ffff888142fe3408 by task syz-executor/6047
[   64.343601][ T6047] 
[   64.345945][ T6047] CPU: 1 UID: 0 PID: 6047 Comm: syz-executor Not tainted 6.13.0-syzkaller-09030-g6d61a53dd6f5 #0
[   64.345971][ T6047] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[   64.345988][ T6047] Call Trace:
[   64.345995][ T6047]  <TASK>
[   64.346008][ T6047]  dump_stack_lvl+0x116/0x1f0
[   64.346038][ T6047]  print_report+0xc3/0x620
[   64.346062][ T6047]  ? __virt_addr_valid+0x5e/0x590
[   64.346082][ T6047]  ? __phys_addr+0xc6/0x150
[   64.346103][ T6047]  kasan_report+0xd9/0x110
[   64.346127][ T6047]  ? binder_add_device+0xa4/0xb0
[   64.346148][ T6047]  ? binder_add_device+0xa4/0xb0
[   64.346171][ T6047]  binder_add_device+0xa4/0xb0
[   64.346192][ T6047]  binderfs_binder_device_create.isra.0+0x8ec/0xad0
[   64.346223][ T6047]  binderfs_fill_super+0x848/0x1240
[   64.346250][ T6047]  ? __pfx_binderfs_fill_super+0x10/0x10
[   64.346285][ T6047]  ? shrinker_register+0x1a8/0x260
[   64.346325][ T6047]  ? sget_fc+0x488/0xb90
[   64.346344][ T6047]  ? apparmor_capable+0x114/0x1d0
[   64.346373][ T6047]  ? __pfx_set_anon_super_fc+0x10/0x10
[   64.346404][ T6047]  ? __pfx_binderfs_fill_super+0x10/0x10
[   64.346428][ T6047]  get_tree_nodev+0xda/0x190
[   64.346449][ T6047]  vfs_get_tree+0x8b/0x340
[   64.346478][ T6047]  path_mount+0x6e1/0x1f00
[   64.346503][ T6047]  ? kmem_cache_free+0x2e2/0x4d0
[   64.346526][ T6047]  ? __pfx_path_mount+0x10/0x10
[   64.346552][ T6047]  ? putname+0x13c/0x180
[   64.346578][ T6047]  __x64_sys_mount+0x28f/0x310
[   64.346603][ T6047]  ? __pfx___x64_sys_mount+0x10/0x10
[   64.346631][ T6047]  do_syscall_64+0xcd/0x250
[   64.346654][ T6047]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   64.346684][ T6047] RIP: 0033:0x7f357118e54a
[   64.346707][ T6047] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   64.346726][ T6047] RSP: 002b:00007ffd64b77948 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[   64.346746][ T6047] RAX: ffffffffffffffda RBX: 00007f357120e663 RCX: 00007f357118e54a
[   64.346761][ T6047] RDX: 00007f357121dda7 RSI: 00007f357120e663 RDI: 00007f357121dda7
[   64.346775][ T6047] RBP: 00007f357120e8ac R08: 0000000000000000 R09: 00000000000001ff
[   64.346788][ T6047] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f35711eb1a8
[   64.346801][ T6047] R13: 00007f35711eb180 R14: 0000000000000009 R15: 0000000000000000
[   64.346821][ T6047]  </TASK>
[   64.346828][ T6047] 
[   64.581804][ T6047] Allocated by task 5831:
[   64.586314][ T6047]  kasan_save_stack+0x33/0x60
[   64.591014][ T6047]  kasan_save_track+0x14/0x30
[   64.595712][ T6047]  __kasan_kmalloc+0xaa/0xb0
[   64.600331][ T6047]  binderfs_binder_device_create.isra.0+0x17a/0xad0
[   64.606940][ T6047]  binderfs_fill_super+0x848/0x1240
[   64.612200][ T6047]  get_tree_nodev+0xda/0x190
[   64.616814][ T6047]  vfs_get_tree+0x8b/0x340
[   64.621351][ T6047]  path_mount+0x6e1/0x1f00
[   64.625885][ T6047]  __x64_sys_mount+0x28f/0x310
[   64.630675][ T6047]  do_syscall_64+0xcd/0x250
[   64.635204][ T6047]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   64.641136][ T6047] 
[   64.643474][ T6047] Freed by task 5831:
[   64.647470][ T6047]  kasan_save_stack+0x33/0x60
[   64.652170][ T6047]  kasan_save_track+0x14/0x30
[   64.656868][ T6047]  kasan_save_free_info+0x3b/0x60
[   64.661925][ T6047]  __kasan_slab_free+0x51/0x70
[   64.666713][ T6047]  kfree+0x2c4/0x4d0
[   64.670622][ T6047]  binderfs_evict_inode+0x1e0/0x250
[   64.675837][ T6047]  evict+0x409/0x960
[   64.679839][ T6047]  iput+0x52a/0x890
[   64.683670][ T6047]  dentry_unlink_inode+0x29c/0x480
[   64.688803][ T6047]  __dentry_kill+0x1d0/0x600
[   64.693430][ T6047]  shrink_dentry_list+0x140/0x5d0
[   64.698483][ T6047]  shrink_dcache_parent+0xe2/0x530
[   64.703628][ T6047]  shrink_dcache_for_umount+0xa1/0x3e0
[   64.709117][ T6047]  generic_shutdown_super+0x6c/0x390
[   64.714425][ T6047]  kill_litter_super+0x70/0xa0
[   64.719211][ T6047]  binderfs_kill_super+0x3b/0xa0
[   64.724173][ T6047]  deactivate_locked_super+0xbe/0x1a0
[   64.729672][ T6047]  deactivate_super+0xde/0x100
[   64.734461][ T6047]  cleanup_mnt+0x222/0x450
[   64.738890][ T6047]  task_work_run+0x14e/0x250
[   64.743647][ T6047]  do_exit+0xad8/0x2d70
[   64.747913][ T6047]  do_group_exit+0xd3/0x2a0
[   64.752435][ T6047]  get_signal+0x2576/0x2610
[   64.757150][ T6047]  arch_do_signal_or_restart+0x90/0x7e0
[   64.762724][ T6047]  syscall_exit_to_user_mode+0x150/0x2a0
[   64.768387][ T6047]  do_syscall_64+0xda/0x250
[   64.772990][ T6047]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   64.778917][ T6047] 
[   64.781256][ T6047] The buggy address belongs to the object at ffff888142fe3400
[   64.781256][ T6047]  which belongs to the cache kmalloc-512 of size 512
[   64.795493][ T6047] The buggy address is located 8 bytes inside of
[   64.795493][ T6047]  freed 512-byte region [ffff888142fe3400, ffff888142fe3600)
[   64.809191][ T6047] 
[   64.811537][ T6047] The buggy address belongs to the physical page:
[   64.817966][ T6047] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x142fe0
[   64.826840][ T6047] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   64.835447][ T6047] flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[   64.843203][ T6047] page_type: f5(slab)
[   64.847501][ T6047] raw: 057ff00000000040 ffff88801b041c80 dead000000000100 dead000000000122
[   64.856107][ T6047] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[   64.864722][ T6047] head: 057ff00000000040 ffff88801b041c80 dead000000000100 dead000000000122
[   64.873418][ T6047] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[   64.882110][ T6047] head: 057ff00000000002 ffffea00050bf801 ffffffffffffffff 0000000000000000
[   64.890801][ T6047] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
[   64.899485][ T6047] page dumped because: kasan: bad access detected
[   64.905924][ T6047] page_owner tracks the page as allocated
[   64.911657][ T6047] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 8666413267, free_ts 0
[   64.931426][ T6047]  post_alloc_hook+0x181/0x1b0
[   64.936223][ T6047]  get_page_from_freelist+0xfce/0x2f80
[   64.941714][ T6047]  __alloc_frozen_pages_noprof+0x221/0x2470
[   64.947637][ T6047]  alloc_pages_mpol+0x1fc/0x540
[   64.952518][ T6047]  new_slab+0x23d/0x330
[   64.956693][ T6047]  ___slab_alloc+0xbfa/0x1600
[   64.961409][ T6047]  __slab_alloc.constprop.0+0x56/0xb0
[   64.966998][ T6047]  __kmalloc_cache_node_noprof+0xfb/0x3f0
[   64.972759][ T6047]  blkg_alloc+0xb7/0xaf0
[   64.977027][ T6047]  blkcg_init_disk+0x51/0x160
[   64.981826][ T6047]  __alloc_disk_node+0x295/0x610
[   64.986785][ T6047]  __blk_mq_alloc_disk+0x89/0x120
[   64.991833][ T6047]  nbd_dev_add+0x4a0/0xbc0
[   64.996272][ T6047]  nbd_init+0x181/0x320
[   65.000459][ T6047]  do_one_initcall+0x128/0x630
[   65.005254][ T6047]  kernel_init_freeable+0x58f/0x8b0
[   65.010471][ T6047] page_owner free stack trace missing
[   65.015853][ T6047] 
[   65.018189][ T6047] Memory state around the buggy address:
[   65.023837][ T6047]  ffff888142fe3300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   65.031925][ T6047]  ffff888142fe3380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   65.040009][ T6047] >ffff888142fe3400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   65.048088][ T6047]                       ^
[   65.052436][ T6047]  ffff888142fe3480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   65.060528][ T6047]  ffff888142fe3500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   65.068603][ T6047] ==================================================================
[   65.168145][ T6047] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   65.175482][ T6047] CPU: 1 UID: 0 PID: 6047 Comm: syz-executor Not tainted 6.13.0-syzkaller-09030-g6d61a53dd6f5 #0
[   65.186018][ T6047] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[   65.196095][ T6047] Call Trace:
[   65.199389][ T6047]  <TASK>
[   65.202338][ T6047]  dump_stack_lvl+0x3d/0x1f0
[   65.206999][ T6047]  panic+0x71d/0x800
[   65.210901][ T6047]  ? __pfx_panic+0x10/0x10
[   65.215662][ T6047]  ? irqentry_exit+0x3b/0x90
[   65.220331][ T6047]  ? lockdep_hardirqs_on+0x7c/0x110
[   65.225709][ T6047]  ? preempt_schedule_thunk+0x1a/0x30
[   65.231097][ T6047]  ? preempt_schedule_common+0x44/0xc0
[   65.236559][ T6047]  ? check_panic_on_warn+0x1f/0xb0
[   65.241751][ T6047]  check_panic_on_warn+0xab/0xb0
[   65.246681][ T6047]  end_report+0x117/0x180
[   65.251008][ T6047]  kasan_report+0xe9/0x110
[   65.255597][ T6047]  ? binder_add_device+0xa4/0xb0
[   65.260792][ T6047]  ? binder_add_device+0xa4/0xb0
[   65.265728][ T6047]  binder_add_device+0xa4/0xb0
[   65.270486][ T6047]  binderfs_binder_device_create.isra.0+0x8ec/0xad0
[   65.277074][ T6047]  binderfs_fill_super+0x848/0x1240
[   65.282275][ T6047]  ? __pfx_binderfs_fill_super+0x10/0x10
[   65.287919][ T6047]  ? shrinker_register+0x1a8/0x260
[   65.293054][ T6047]  ? sget_fc+0x488/0xb90
[   65.297317][ T6047]  ? apparmor_capable+0x114/0x1d0
[   65.302390][ T6047]  ? __pfx_set_anon_super_fc+0x10/0x10
[   65.307875][ T6047]  ? __pfx_binderfs_fill_super+0x10/0x10
[   65.313525][ T6047]  get_tree_nodev+0xda/0x190
[   65.318135][ T6047]  vfs_get_tree+0x8b/0x340
[   65.322582][ T6047]  path_mount+0x6e1/0x1f00
[   65.327026][ T6047]  ? kmem_cache_free+0x2e2/0x4d0
[   65.331968][ T6047]  ? __pfx_path_mount+0x10/0x10
[   65.336852][ T6047]  ? putname+0x13c/0x180
[   65.341100][ T6047]  __x64_sys_mount+0x28f/0x310
[   65.345870][ T6047]  ? __pfx___x64_sys_mount+0x10/0x10
[   65.351246][ T6047]  do_syscall_64+0xcd/0x250
[   65.355753][ T6047]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   65.361655][ T6047] RIP: 0033:0x7f357118e54a
[   65.366068][ T6047] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   65.385871][ T6047] RSP: 002b:00007ffd64b77948 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[   65.394293][ T6047] RAX: ffffffffffffffda RBX: 00007f357120e663 RCX: 00007f357118e54a
[   65.402272][ T6047] RDX: 00007f357121dda7 RSI: 00007f357120e663 RDI: 00007f357121dda7
[   65.410323][ T6047] RBP: 00007f357120e8ac R08: 0000000000000000 R09: 00000000000001ff
[   65.418404][ T6047] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f35711eb1a8
[   65.426370][ T6047] R13: 00007f35711eb180 R14: 0000000000000009 R15: 0000000000000000
[   65.434345][ T6047]  </TASK>
[   65.437672][ T6047] Kernel Offset: disabled
[   65.441996][ T6047] Rebooting in 86400 seconds..